HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
Corban OneSource, LLC
bd_5e362bae54b7ef89 · schema v1 · pii pii-v1
Full breach record for Corban OneSource, LLC →Corban OneSource, LLC notified the New Hampshire Attorney General of a cybersecurity incident discovered on September 9, 2025. Unauthorized access resulted in the exfiltration of names and Social Security numbers for 12 New Hampshire residents (employees, customers, or vendors). Notification letters were sent on February 4, 2026, offering one year of credit monitoring via Epiq. Law enforcement was notified.
Leak gap clock⏱ Leak >90d21 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 2 about the same incident.View merged incident
A leak claim by qilin about this victim predates this filing by 124 days.View originating leak claim
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_821d65efb8e4c49dIndiana State AGfiled 2026-02-04Candidate
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/corban-onesource-20260204.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Feb 4, 2026
- Raw hash
- fb69169980320ee3760d5a434c4b03d18fd132e2a9a5a2324fab0fdf85e58aea
Reporting entity
- Name
- Corban OneSource, LLCnorm: corban onesource
- Domain
- corbanone.com
Victim entity
- Name
- Corban OneSource, LLCnorm: corban onesource
- Domain
- corbanone.com
Incident
- Discovered
- Sep 9, 2025
- Materiality determined
- —
- Notification sent
- Feb 4, 2026
- Affected individuals
- 12
- Data types
- IDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Notified law enforcement
- Initial access
- valid_credentials
Compliance
- Time to disclose
- 21 weeks(148 days from discovery to filing)
- Compliance flags
- Leak >90d
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.